Body
If you use a Windows computer managed by the University of Maine System (UMS), setting up Windows Hello for Business (WHfB) automatically registers it as a multi-factor authentication (MFA) sign-in method on your UMS account. You do not need to add it yourself.
Detailed Information
How Windows Hello for Business differs from Windows Hello
Windows Hello lets you sign in to a Windows computer with your face, fingerprint, or PIN instead of a password.
WHfB builds on Windows Hello by adding security and management features designed for organizations. On UMS-managed computers, UMS can apply security settings through WHfB to keep the computer secure and in line with university requirements. For example, WHfB can confirm the computer is a trusted device, and UMS security policies can control when and how you sign in.
How Windows Hello for Business works with MFA
- When you set up WHfB on your UMS-managed computer, it is automatically registered as an MFA sign-in method on your UMS account.
- The passkey is saved on your computer. See Viewing your passkey in Windows below.
- You do not need to add it manually at accounts.maine.edu/mymfa.
- WHfB will not appear under Security info with your other sign-in methods. This is expected.
- WHfB works only on the computer where you set it up. Your PIN will not work on any other device.
- If you sign in on more than one UMS-managed computer, set up WHfB on each one. If your computer is replaced or reimaged, you will need to set it up again.
Setting up Windows Hello for Business
To set up WHfB on your UMS-managed computer, see Enrolling in Windows Hello for Business.
When you choose your PIN, Windows blocks simple patterns, such as 1111, 1234, or 1357. Choose a PIN without a repeating or evenly spaced pattern. If your PIN includes letters, this check does not apply.
You can use the Windows Settings app to view and delete passkeys saved on your computer.
- Open the Settings app on your Windows computer.
- Select Accounts → Passkeys.
Network requirements
For UMS-managed computers, WHfB works only when your computer is connected to the UMS network. You must be on the University VPN, the eduroam wireless network, or ethernet while on campus.
If you are not connected, you may see the message This sign-in option is only available when connected to your organization's network. Sign in with your password instead, or connect to the UMS network and try again.
Biometrics and privacy
- Signing in with your face or fingerprint is optional. You can always use your PIN only.
- A PIN is always required. It is your backup when face or fingerprint sign-in is not available, for example if the sensor is not working.
- Your face or fingerprint data is encrypted and stored only on your computer. It never leaves your device and is never sent to Microsoft or any other server.
To remove face or fingerprint sign-in:
- Open the Settings app on your Windows computer.
- Select Accounts → Sign-in options.
- Select the face or fingerprint option, then select Remove.
Removing it also deletes the stored face or fingerprint data from your computer.
Common questions about Windows Hello for Business, Microsoft Learn (External Link)
Using Windows Hello with a secondary account
WHfB is only for primary accounts. To use Windows Hello with a secondary account (aux, utility, priv, etc.), follow Add MFA Sign-in Method: Windows Hello (Entra MFA) instead.
Other limits
- Shared computers: WHfB is intended for a computer assigned to you. Up to 10 people can set up WHfB on a single computer.
- Remote Desktop: You can use WHfB on your own computer to sign in to a remote computer, but you cannot set up or use WHfB on the remote computer itself.
Additional resources
Environment
- UMS-managed Windows computers
- Primary UMS accounts
- Microsoft Entra ID
- Windows 10 or Windows 11